Red Hat OpenShift automated deployment

MetalSoft provides a series of “application extensions” that allow 3rd party applications to be deployed via the UI, Terraform or API.

To create an OpenShift extension follow the instructions below.

Prerequisites

The Ansible Runner capability must be enabled on the site controller in order for this task type to be supported. See Enabling the Ansible Runner Capability for more details.
The DNS workflow extension must be installed and active as the OpenShift extension uses it to create DNS records for the nodes that it deploys. Note, that both forward and a reverse DNS must function correctly. View PowerDNS integration for an example integration. The OpenShift installed CoreOS must be able to resolve the records that get created in that extension managed DNS server.
Local Registry (only needed in air-gapped or disconnected environments). In certain cases, it is necessary to have a local registry with the necessary images as the extension does not provide the images.

Mirroring Red Hat’s Openshift Docker images from quay.io (for an air-gapped environment)

In certain circumstances (such as in air-gapped environments) it is necessary to have a local mirror of the Openshift Docker images and host them in a local registry like Artifactory, Harbor, etc. Here are the steps to achieve it:

Open a terminal session into a machine that can reach both quay.io and your local registry.
Log into quay.io and your local registry, ex.

docker login quay.io
docker login registry.metalsoft.dev

Note: if you are on a Mac, your creds are being stored into the keychain, which Openshift’s oc command does not (currently) read. This means that you will need to generate base64 encoded version of your user/pass and add them to the config file (~/.docker/config.json) manually.

Clone the images on your local repository.

oc adm release mirror \
  --from=http://quay.io/openshift-release-dev/ocp-release:4.19.0-x86_64 \
  --to=registry.metalsoft.dev/ocp4/openshift4 \
  --to-release-image=registry.metalsoft.dev/ocp4/openshift4:4.19.0

Update image:  registry.metalsoft.dev/ocp4/openshift4:4.19.0
Mirror prefix: registry.metalsoft.dev/ocp4/openshift4
Mirror prefix: registry.metalsoft.dev/ocp4/openshift4:4.19.0

Note: The project (ocp4 in registry.metalsoft.dev/ocp4) must exist (be pre-created)

OpenShift tooling (provided via the execution environment)

An execution environment is the container image in which the Site Controller runs an extension’s Ansible tasks — everything a playbook needs at runtime (Galaxy collections, Python modules, CLI tools) must be baked into that image.

The OpenShift client tools (oc, openshift-install) therefore do not need to be installed on the Site Controller. The extension ships them in its own execution environment image, declared as an OciImage asset in the extension definition and selected by each Ansible task via the ee option — the tasks run in that container image, with the tooling already baked in.

To use a different OpenShift tool version, build and publish a new execution environment image containing the desired binaries and update the OciImage asset’s registry fields (and, for air-gapped sites, the image tarball url) in the extension definition.

Creating the OpenShift Application extension

Clone the repository with sample Openshift extension definition.

git clone https://github.com/metalsoft-io/metalsoft-extensions

Archive the Ansible bundle used by the extension.

(cd metalsoft-extensions/redhat-openshift/ansible && zip -r ../../redhat-openshift-v1.0.1.zip . -x '*.DS_Store')

Upload the resulting archive to a repository (web hosting) reachable from the Global Controller.
Modify the extension.json file with the URL of the Ansible bundle and the location of the execution environment image. Ex.

...
  "assets": [
    {
      "label": "openshift-ansible-bundle",
      "name": "openshift-ansible-bundle",
      "assetType": "AnsibleBundle",
      "url": "https://repo.metalsoft.io/.extensions_ms/redhat-openshift/redhat-openshift-v1.0.1.zip"
    },
    {
      "label": "ee-redhat-openshift",
      "name": "ee-redhat-openshift",
      "assetType": "OciImage",
      "url": "https://repo.metalsoft.io/.extensions_ms/ee/ee-ocd-4-19_v1.0.0.tar.gz",
      "repositoryRegistry": "registry.metalsoft.dev",
      "namespaceRegistry": "ee-ocd-4-19",
      "tagRegistry": "4-19"
    }
  ],
...

The OciImage asset is the execution environment containing the OpenShift tooling; its registry must be reachable by the Site Controller (for air-gapped sites the image tarball at url is loaded into a site-local registry).

Update the network profile in the extension.json file. The infrastructure.logicalNetworks[].profileLabel field must reference a logical network profile that exists in all sites where the OpenShift app will be deployed — adjust it to match your site’s profile. Ex.

...
  "logicalNetworks": [
    {
      "label": "openshift-network",
      "profileLabel": "openshift-network-profile",
...

Create the extension definition draft in Metalsoft.

metalcloud-cli extension create openshift application "Red Hat OpenShift" --definition-source redhat-openshift/extension.json

Activate the extension.

metalcloud-cli extension publish <id-of-created-extension>

Enable the extension on the site level and configure its configVars. After publishing, the extension must also be activated per site, on the site level configuration page. This is also where its configVars — the operator-set, site-level settings — are configured, and it must be done before the first deploy:
- DNSResolvers — set to your site’s internal resolvers (comma-separated); they must be able to resolve the cluster DNS records created via the DNS workflow extension.
- pull_secret — your Red Hat pull secret (the committed default is a placeholder).
- use_private_registry / mirror_registry — enable and point at your local mirror registry in air-gapped or disconnected environments (see the mirroring section above).
- ocp_version — the OpenShift version to install (default 4.19.0).
- mtu — the MTU used for the cluster network (default 1500).

You should now be ready to deploy the OpenShift application from the Infrastructure Designer